1
00:00:06,480 --> 00:00:09,390
- Welcome to lesson six, deep dive quiz.

2
00:00:09,390 --> 00:00:11,160
The lesson six was all about

3
00:00:11,160 --> 00:00:14,100
common threat vectors and attack surfaces.

4
00:00:14,100 --> 00:00:15,360
In lesson six one,

5
00:00:15,360 --> 00:00:17,790
we explored operational threat vectors.

6
00:00:17,790 --> 00:00:19,230
In six two, we took a look

7
00:00:19,230 --> 00:00:21,720
at third party and supply
chain threat vectors.

8
00:00:21,720 --> 00:00:23,280
And in lesson three we looked

9
00:00:23,280 --> 00:00:24,750
at the human threat vector,

10
00:00:24,750 --> 00:00:27,540
specifically at social engineering.

11
00:00:27,540 --> 00:00:29,430
So we're gonna do five questions together

12
00:00:29,430 --> 00:00:30,420
about the materials

13
00:00:30,420 --> 00:00:32,790
that we just covered in lesson six.

14
00:00:32,790 --> 00:00:34,320
Make sure you have a pencil and a piece

15
00:00:34,320 --> 00:00:36,090
of paper and put me on pause

16
00:00:36,090 --> 00:00:37,980
as many times as you need to.

17
00:00:37,980 --> 00:00:38,850
Are you ready?

18
00:00:38,850 --> 00:00:39,683
Let's go.

19
00:00:41,490 --> 00:00:43,020
The root of this significant

20
00:00:43,020 --> 00:00:44,723
operational issue is the use

21
00:00:44,723 --> 00:00:47,580
of IT solutions that are managed outside

22
00:00:47,580 --> 00:00:50,942
of and without the knowledge
of the IT department.

23
00:00:50,942 --> 00:00:53,370
Is this data exfiltration,

24
00:00:53,370 --> 00:00:54,990
shadow IT,

25
00:00:54,990 --> 00:00:56,610
vulnerable software

26
00:00:56,610 --> 00:00:59,010
or default credentials?

27
00:00:59,010 --> 00:01:00,420
Now, these were all operational

28
00:01:00,420 --> 00:01:01,830
issues that we talked about

29
00:01:01,830 --> 00:01:04,290
but which one of them describes the use

30
00:01:04,290 --> 00:01:06,271
of IT solutions that are managed outside

31
00:01:06,271 --> 00:01:10,200
of and without the knowledge
of the IT department?

32
00:01:10,200 --> 00:01:11,700
Go ahead and make your choice.

33
00:01:12,810 --> 00:01:15,450
I'm gonna choose shadow IT,

34
00:01:15,450 --> 00:01:17,400
because shadow IT is the use

35
00:01:17,400 --> 00:01:19,620
of IT solutions that
could be local, you know

36
00:01:19,620 --> 00:01:21,390
on-prem or cloud-based,

37
00:01:21,390 --> 00:01:22,860
but they're managed outside

38
00:01:22,860 --> 00:01:25,170
of and without the knowledge
of the IT department

39
00:01:25,170 --> 00:01:26,580
so that they can't ever have

40
00:01:26,580 --> 00:01:29,130
the opportunity to put the
right controls in place.

41
00:01:29,130 --> 00:01:32,910
Data exfiltration is where
data leaves our environment.

42
00:01:32,910 --> 00:01:33,990
Vulnerable software.

43
00:01:33,990 --> 00:01:36,480
The software that has
obviously vulnerabilities

44
00:01:36,480 --> 00:01:39,240
and needs to be patched
and default credentials

45
00:01:39,240 --> 00:01:41,250
is using the default credentials

46
00:01:41,250 --> 00:01:42,690
that comes standard, right,

47
00:01:42,690 --> 00:01:44,910
with an application or software

48
00:01:44,910 --> 00:01:47,100
or you know, a device.

49
00:01:47,100 --> 00:01:48,270
And usually those can be found

50
00:01:48,270 --> 00:01:50,190
because they're published on the internet.

51
00:01:50,190 --> 00:01:51,230
So I'm choosing shadow IT.

52
00:01:51,230 --> 00:01:52,680
Do you agree?

53
00:01:52,680 --> 00:01:53,640
Let's check.

54
00:01:53,640 --> 00:01:54,753
And that is correct.

55
00:01:57,136 --> 00:01:57,969
All right, so the biggie,

56
00:01:57,969 --> 00:01:59,970
we're gonna match the
social engineering tools

57
00:01:59,970 --> 00:02:01,590
and descriptions.

58
00:02:01,590 --> 00:02:03,270
So the tools on the left hand side

59
00:02:03,270 --> 00:02:06,930
we have a social profile,
spy cams, website,

60
00:02:06,930 --> 00:02:10,110
branded clothing, and a
phone spoofing service.

61
00:02:10,110 --> 00:02:10,943
On the right side

62
00:02:10,943 --> 00:02:14,550
we have an online presence
to establish legitimacy

63
00:02:14,550 --> 00:02:18,120
and online presence to
establish relationships.

64
00:02:18,120 --> 00:02:21,510
Used to manipulate caller
ID, used to substantiate

65
00:02:21,510 --> 00:02:24,843
an identity or used to capture live feed.

66
00:02:26,580 --> 00:02:28,320
So let's start on the
right hand side this time.

67
00:02:28,320 --> 00:02:30,900
Used to establish online presence,

68
00:02:30,900 --> 00:02:32,760
used to establish legitimacy.

69
00:02:32,760 --> 00:02:35,400
Hmm, that could be a social profile,

70
00:02:35,400 --> 00:02:36,810
'cause that's online

71
00:02:36,810 --> 00:02:38,190
but we know we have another option,

72
00:02:38,190 --> 00:02:41,100
online presence to
establish relationships.

73
00:02:41,100 --> 00:02:43,200
So I think that one's gonna really work

74
00:02:43,200 --> 00:02:44,550
for social profile.

75
00:02:44,550 --> 00:02:45,690
Oh, you know, I forgot to tell you.

76
00:02:45,690 --> 00:02:46,890
If you want, don't hesitate

77
00:02:46,890 --> 00:02:48,390
to put me on pause

78
00:02:48,390 --> 00:02:49,770
while you work through this and then

79
00:02:49,770 --> 00:02:51,810
I'm gonna work through it as well.

80
00:02:51,810 --> 00:02:54,210
So online presence to
establish legitimacy,

81
00:02:54,210 --> 00:02:55,410
I'm gonna go to website.

82
00:02:56,880 --> 00:03:00,660
Next, use to manipulate caller ID.

83
00:03:00,660 --> 00:03:02,400
Well that might has to do with my phone.

84
00:03:02,400 --> 00:03:03,360
So I'm gonna come down

85
00:03:03,360 --> 00:03:05,313
to my phone spoofing service.

86
00:03:06,180 --> 00:03:08,730
The next I have used
to capture live feeds.

87
00:03:08,730 --> 00:03:11,100
That's gonna be video.

88
00:03:11,100 --> 00:03:12,663
That must be a spy cam.

89
00:03:13,650 --> 00:03:16,200
Online presence to
establish relationships.

90
00:03:16,200 --> 00:03:17,880
So I've got social media, excuse me,

91
00:03:17,880 --> 00:03:21,120
social profile and branded clothing left.

92
00:03:21,120 --> 00:03:23,760
I'm gonna go with social profile

93
00:03:23,760 --> 00:03:24,810
and branded clothing.

94
00:03:24,810 --> 00:03:27,930
Well that's used to
substantiate an identity.

95
00:03:27,930 --> 00:03:29,730
So we set a social profile tool.

96
00:03:29,730 --> 00:03:31,950
We use it to an online presence

97
00:03:31,950 --> 00:03:33,630
to establish relationships.

98
00:03:33,630 --> 00:03:36,300
Our spy cams are used
to capture live feed.

99
00:03:36,300 --> 00:03:39,360
Our website are used
to have online presence

100
00:03:39,360 --> 00:03:41,220
to establish legitimacy.

101
00:03:41,220 --> 00:03:42,360
Branded clothing are used

102
00:03:42,360 --> 00:03:44,370
to substantiate an identity.

103
00:03:44,370 --> 00:03:45,571
And a phone spoofing service

104
00:03:45,571 --> 00:03:48,210
is used to manipulate caller ID.

105
00:03:48,210 --> 00:03:49,140
Do you agree?

106
00:03:49,140 --> 00:03:49,983
Let's check.

107
00:03:51,300 --> 00:03:53,146
And those are correct.

108
00:03:53,146 --> 00:03:55,320
(mouse clicking)

109
00:03:55,320 --> 00:03:56,350
This is a term that describes

110
00:03:56,350 --> 00:03:59,160
the sum of all threat vectors,

111
00:03:59,160 --> 00:04:02,370
a threat footprint, a privilege pathway,

112
00:04:02,370 --> 00:04:05,700
an attack surface or a
vulnerability platform.

113
00:04:05,700 --> 00:04:06,930
Now, some of these are made up terms,

114
00:04:06,930 --> 00:04:07,920
pretty good made up terms,

115
00:04:07,920 --> 00:04:10,020
but made up terms nonetheless.

116
00:04:10,020 --> 00:04:14,130
Tell me which one is the
sum of all threat vectors.

117
00:04:14,130 --> 00:04:17,070
Put me on pause while you think
through this, if you want.

118
00:04:17,070 --> 00:04:19,020
Threat footprint, privilege pathway,

119
00:04:19,020 --> 00:04:21,873
attack surface or vulnerability platform.

120
00:04:24,210 --> 00:04:26,520
I'm gonna choose attack surface.

121
00:04:26,520 --> 00:04:27,630
Because the attack surface

122
00:04:27,630 --> 00:04:29,913
is the sum of all threat vectors.

123
00:04:30,780 --> 00:04:31,860
Let's check.

124
00:04:31,860 --> 00:04:33,003
And that is correct.

125
00:04:34,693 --> 00:04:37,470
All right, which one of
the following is not?

126
00:04:37,470 --> 00:04:39,270
Not, again, we're looking for that word,

127
00:04:39,270 --> 00:04:42,960
not a supply chain security risk?

128
00:04:42,960 --> 00:04:45,930
Business failure, non-compliance,

129
00:04:45,930 --> 00:04:48,873
limited visibility or lower pricing.

130
00:04:49,717 --> 00:04:51,930
Now, in reading really carefully

131
00:04:51,930 --> 00:04:54,000
the sentence is not so,

132
00:04:54,000 --> 00:04:58,680
which one is not supply
chain security risk?

133
00:04:58,680 --> 00:05:00,510
Not just a supply chain risk

134
00:05:00,510 --> 00:05:03,780
but a supply chain security risk,

135
00:05:03,780 --> 00:05:06,210
business failure, non-compliance,

136
00:05:06,210 --> 00:05:09,660
limited visibility or lower pricing.

137
00:05:09,660 --> 00:05:12,990
Which is not a supply chain security risk?

138
00:05:12,990 --> 00:05:14,013
Make that choice.

139
00:05:15,450 --> 00:05:19,320
I'm gonna choose lower pricing, right?

140
00:05:19,320 --> 00:05:20,370
It's not really a risk probably

141
00:05:20,370 --> 00:05:21,203
to have lower pricing

142
00:05:21,203 --> 00:05:22,950
but it's definitely not a security risk

143
00:05:22,950 --> 00:05:24,390
but a business failure, right?

144
00:05:24,390 --> 00:05:25,860
The failure of availability

145
00:05:25,860 --> 00:05:27,330
would be a security risk.

146
00:05:27,330 --> 00:05:29,760
Non-compliance, definitely
a security risk.

147
00:05:29,760 --> 00:05:31,436
Limited visibility into what's going

148
00:05:31,436 --> 00:05:33,930
on is also a security risk.

149
00:05:33,930 --> 00:05:36,690
Lower pricing, not a security risk.

150
00:05:36,690 --> 00:05:37,523
You agree?

151
00:05:37,523 --> 00:05:38,356
Let's check.

152
00:05:39,750 --> 00:05:41,013
And that is correct.

153
00:05:42,330 --> 00:05:43,500
All right, our last question.

154
00:05:43,500 --> 00:05:45,630
This one, we're going to
drag the words to complete

155
00:05:45,630 --> 00:05:49,350
the sentence about influence
campaign techniques.

156
00:05:49,350 --> 00:05:50,940
Blank is fault or misleading

157
00:05:50,940 --> 00:05:52,800
information that is deliberately spread

158
00:05:52,800 --> 00:05:55,140
with the intent of deception.

159
00:05:55,140 --> 00:05:56,700
Blank is when machine learning

160
00:05:56,700 --> 00:05:58,050
and or artificial intelligence

161
00:05:58,050 --> 00:06:01,650
is used to generate deceptive
audio or video content.

162
00:06:01,650 --> 00:06:04,350
And blank is a use of persistent denial,

163
00:06:04,350 --> 00:06:07,200
false narrative and lying
to confuse the target

164
00:06:07,200 --> 00:06:10,290
and disrupt their sense of reality.

165
00:06:10,290 --> 00:06:14,040
Disinformation, poisoning, gaslighting

166
00:06:14,040 --> 00:06:18,240
deep fake, misinformation and pretexting.

167
00:06:18,240 --> 00:06:19,073
I'll tell you that one

168
00:06:19,073 --> 00:06:20,760
of these answers we actually didn't talk

169
00:06:20,760 --> 00:06:21,593
about in the lesson,

170
00:06:21,593 --> 00:06:23,340
but we'll talk about here.

171
00:06:23,340 --> 00:06:25,530
So go ahead and put me on pause.

172
00:06:25,530 --> 00:06:27,930
Go ahead and see what you put in there.

173
00:06:27,930 --> 00:06:28,763
Are you ready?

174
00:06:28,763 --> 00:06:29,596
All right.

175
00:06:29,596 --> 00:06:30,960
Blank is false

176
00:06:30,960 --> 00:06:32,010
or misleading information

177
00:06:32,010 --> 00:06:33,510
that's deliberately spread,

178
00:06:33,510 --> 00:06:35,850
that's gonna be disinformation.

179
00:06:35,850 --> 00:06:37,530
Remember, the difference
between disinformation

180
00:06:37,530 --> 00:06:38,670
and misinformation is,

181
00:06:38,670 --> 00:06:41,100
disinformation is deliberately spread

182
00:06:41,100 --> 00:06:43,350
with the intent of deception.

183
00:06:43,350 --> 00:06:44,773
Blank is when machine
learning or artificial

184
00:06:44,773 --> 00:06:49,773
intelligence is used to
generate deceptive audio

185
00:06:50,250 --> 00:06:54,300
or video content, that is
going to be a deep fake.

186
00:06:54,300 --> 00:06:56,820
And this last one I didn't
talk about in the lesson.

187
00:06:56,820 --> 00:06:58,110
So let's talk about now,

188
00:06:58,110 --> 00:07:00,780
the last one is actually gaslighting.

189
00:07:00,780 --> 00:07:03,990
Gaslighting is a use of persistent denial

190
00:07:03,990 --> 00:07:07,050
a false narrative or
lying to confuse a target

191
00:07:07,050 --> 00:07:10,200
and really disrupt their sense of reality.

192
00:07:10,200 --> 00:07:12,690
So gaslighting is the answer
we were looking for here.

193
00:07:12,690 --> 00:07:14,760
We're seeing gaslighting
in social engineering.

194
00:07:14,760 --> 00:07:15,719
We see gaslighting a lot

195
00:07:15,719 --> 00:07:17,970
in the political arena as well.

196
00:07:17,970 --> 00:07:20,280
We see gaslighting in relationships.

197
00:07:20,280 --> 00:07:22,440
It's a use of that persistent denial.

198
00:07:22,440 --> 00:07:24,180
No, it didn't happen that way.

199
00:07:24,180 --> 00:07:26,460
No, that's not what it,
you know what it does.

200
00:07:26,460 --> 00:07:28,200
No, you don't understand.

201
00:07:28,200 --> 00:07:29,820
No, you don't get it,

202
00:07:29,820 --> 00:07:32,124
over and over again to confuse a target

203
00:07:32,124 --> 00:07:34,293
and disrupt their sense of reality.

204
00:07:35,160 --> 00:07:36,177
So disinformation is false

205
00:07:36,177 --> 00:07:37,890
and misleading information,

206
00:07:37,890 --> 00:07:40,650
deep fake generates that deceptive audio

207
00:07:40,650 --> 00:07:43,530
or video content and gaslighting disrupts

208
00:07:43,530 --> 00:07:45,330
our sense of reality.

209
00:07:45,330 --> 00:07:46,260
Agree.

210
00:07:46,260 --> 00:07:48,090
All right, let's check it.

211
00:07:48,090 --> 00:07:48,923
And there we go.

212
00:07:48,923 --> 00:07:49,830
Correct.

213
00:07:49,830 --> 00:07:50,663
Awesome.

214
00:07:50,663 --> 00:07:51,496
Five questions together.

215
00:07:51,496 --> 00:07:52,329
You did perfect.

216
00:07:52,329 --> 00:07:53,162
Great job.

217
00:07:53,162 --> 00:07:55,740
So up next we're gonna
go into lesson seven.

218
00:07:55,740 --> 00:07:58,560
We're gonna explain various
types of vulnerabilities.

219
00:07:58,560 --> 00:07:59,430
What's a vulnerability?

220
00:07:59,430 --> 00:08:00,900
You know, it's a weakness.

221
00:08:00,900 --> 00:08:03,900
So we'll be explaining
various types of weaknesses.

222
00:08:03,900 --> 00:08:04,850
I'll see you there.